Detections
Analytics
OL09-00-002426 - OL 9 Trivial File Transfer Protocol (TFTP) daemon must be configured to operate in secure mode if the TFTP server is required.
Information
Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files. Using the "-s" option causes the TFTP service to only serve files from the given directory.Solution
Configure the TFTP daemon to operate in secure mode.Find the path for the systemd service.
$ sudo systemctl show tftp | grep FragmentPath=
FragmentPath=/etc/systemd/system/tftp.service
Edit the ExecStart line on that file to add the -s option with a subdirectory.
ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_9_V1R6_STIG.zip
Item Details
Audit Name: DISA Oracle Linux 9 STIG v1r6
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-271764r1092004_rule, STIG-ID|OL09-00-002426, Vuln-ID|V-271764
Plugin: Unix
Control ID: 062f98316f16ca10625837d202e796a7d73fe57332d6492f4b5f09d7ff962d29